As you may already know, DTLS is a protocol designed to secure communication over UDP, particularly suited for constrained IoT devices and use cases where low latency is crucial. wolfSSL stands out as the first provider of a production-ready implementation of the DTLS v1.3 protocol, which is based on TLS v1.3. One of the key advantages of wolfSSL’s DTLS v1.3 implementation is its ability to reuse most parts of the mature wolfSSL TLS 1.3 stack. This not only enables broad hardware support but also ensures that all wolfSSL features, such as post-quantum, HSMs, etc. are supported out of the box.
Indeed only some minor tweaks were needed to add Authentication and Integrity-Only cipher suites support for DTLS v1.3 in wolfSSL version 5.6.2! These cipher suites (TLS_SHA256_SHA256 and TLS_SHA384_SHA384) ensure authentication and integrity but do not provide confidentiality, as messages are sent in clear form. This means that you can be assured of the identity of the communicating entities and promptly detect any unauthorized modifications of the messages, even if they can be read by anyone that can intercept the communication.
There are numerous use cases where authenticity and integrity are of utmost importance, even if confidentiality is not a requirement. This can be especially advantageous for memory and performance-constrained devices, where no confidentiality can lower the number of required cryptographic algorithms, leading to efficient utilization of scarce resources. Industrial automation, industrial control, railways, and civil avionics are a few examples of industries where these cipher suites find practical applications. In other scenarios, third-party inspection of the communication is needed while preserving authenticity and integrity properties; this is also supported thanks to the lack of confidentiality of these cipher suites.
For example RFC 9372 (L-Band Digital Aeronautical Communications System – LDACS), explain how ICAO doc 9896 foresee layer security for all aeronautical data and that DTLS v1.3 provides the security requirement reported from ARINC 858P1. To further insights into how Authentication and Integrity-Only Cipher Suites can be used, refer to RFC 9150, which outlines typical use case scenarios.
In summary wolfSSL’s DTLS v1.3 implementation offers yet another feature: the ability to run on highly constrained memory and performance devices with Authentication and Integrity-Only Cipher Suites. This paves the way for providing authentication and integrity protection while allowing third-party inspection of the communication. To start exploring these capabilities, you can download the source code from our repository on GitHub at https://github.com/wolfSSL/wolfssl.
If you have any feedback, questions, or require support, please don’t hesitate to reach out to us via facts@wolfSSL.com, or call us at +1 425 245 8247.
Download wolfSSL